feat: admin settings page UI/UX pass with WordPress-native patterns

- Header: h1 + logo in a wrapping flex row, hr.wp-header-end before the tabs,
  aria-current on the active tab; own CSS/JS enqueued only on this screen.
- Verbindung: ordered "So verbindest du Claude" steps, copy button (core
  clipboard.js + wp.a11y.speak), Site-Health-style status list, German details.
- Zugriff: roles as form-table fieldset, connections with site date format,
  empty-state row, confirm on revoke; ConnectionUsage records last use via
  WP_Application_Passwords::record_application_password_usage (once a day).
- Tools: plain-language legend, counter as inline notice, groups as core
  postboxes (postbox.js toggles, per-user closed state, summary when closed),
  fixed column widths with new "Art" column, submit above and below.
- Protokoll: site-timezone times with UTC tooltip, result icons, filters with
  labels in the list table nav, retention link to Limits.
- Limits: short labels with units and descriptions; snapshot count hidden but
  preserved.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/Unit/Admin/SettingsPageTest.php

@@ -53,7 +53,8 @@ final class SettingsPageTest extends TestCase
 
         self::assertStringContainsString('Inhalt zugriff', $html);
         self::assertStringNotContainsString('Inhalt verbindung', $html);
-        self::assertMatchesRegularExpression('/tab=zugriff" class="nav-tab nav-tab-active"/', $html);
+        self::assertMatchesRegularExpression('/tab=zugriff" class="nav-tab nav-tab-active" aria-current="page"/', $html);
+        self::assertMatchesRegularExpression('/tab=verbindung" class="nav-tab">/', $html);
         self::assertSame(['verbindung', 'zugriff'], $page->tabSlugs());
     }
 
@@ -70,8 +71,53 @@ final class SettingsPageTest extends TestCase
         $withoutLogo = (string) ob_get_clean();
 
         self::assertStringContainsString('<img src="https://example.test/logo.svg" alt="Loosen-IT Logo"', $withLogo);
-        self::assertStringContainsString('right:0', $withLogo);
         self::assertStringNotContainsString('lit-mcp-logo', $withoutLogo);
+        // Logo sits in the header next to the h1 (flex, no absolute positioning over the title).
+        self::assertLessThan(strpos($withLogo, 'lit-mcp-logo'), strpos($withLogo, '<h1'));
+        self::assertStringNotContainsString('position:absolute', $withLogo);
+    }
+
+    public function testHeaderEndMarkerSitsBetweenTitleAndTabsWithNoticesAfterIt(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+        $_GET['lit_mcp_notice'] = 'revoked';
+
+        ob_start();
+        (new SettingsPage([$this->tab('verbindung', 'Verbindung')]))->render();
+        $html = (string) ob_get_clean();
+
+        $h1 = (int) strpos($html, '<h1');
+        $end = strpos($html, '<hr class="wp-header-end">');
+        self::assertNotFalse($end);
+        self::assertLessThan($end, $h1);
+        self::assertLessThan(strpos($html, 'notice-success'), $end);
+        self::assertLessThan(strpos($html, 'nav-tab-wrapper'), (int) strpos($html, 'notice-success'));
+        self::assertStringContainsString('<nav class="nav-tab-wrapper wp-clearfix" aria-label="', $html);
+    }
+
+    public function testEnqueuesStylesAndCopyScriptOnlyOnItsOwnScreen(): void
+    {
+        $page = new SettingsPage([$this->tab('verbindung', 'Verbindung')], '', 'https://example.test/assets', '1.2.3');
+        Functions\expect('wp_enqueue_style')->once()
+            ->with('lit-mcp-admin', 'https://example.test/assets/css/admin.css', [], '1.2.3');
+        Functions\expect('wp_enqueue_script')->once()
+            ->with('lit-mcp-admin', 'https://example.test/assets/js/admin.js', ['clipboard', 'wp-a11y'], '1.2.3', true);
+        Functions\when('wp_localize_script')->justReturn(true);
+
+        $page->enqueueAssets('settings_page_lit-mcp');
+        $page->enqueueAssets('options-general.php');
+    }
+
+    public function testToolsTabAlsoLoadsWordPressPostboxScriptForCollapsibleGroups(): void
+    {
+        $_GET['tab'] = 'tools';
+        $page = new SettingsPage([$this->tab('verbindung', 'V'), $this->tab('tools', 'T')], '', 'https://example.test/assets/', '1');
+        Functions\when('wp_enqueue_style')->justReturn(null);
+        Functions\expect('wp_enqueue_script')->once()
+            ->with('lit-mcp-admin', 'https://example.test/assets/js/admin.js', ['clipboard', 'wp-a11y', 'postbox'], '1', true);
+        Functions\when('wp_localize_script')->justReturn(true);
+
+        $page->enqueueAssets('settings_page_lit-mcp');
     }
 
     public function testUnknownTabFallsBackToTheFirstAndNoticesAreShown(): void
@@ -108,6 +154,7 @@ final class SettingsPageTest extends TestCase
         $page = new SettingsPage([$tab]);
         Functions\expect('add_action')->once()->with('admin_menu', [$page, 'addMenu']);
         Functions\expect('add_action')->once()->with('admin_init', [$page, 'registerSettings']);
+        Functions\expect('add_action')->once()->with('admin_enqueue_scripts', [$page, 'enqueueAssets']);
 
         $page->register();
     }